Executive brief
The Linux kernel's f2fs filesystem can enter an infinite loop when two operations race: one thread attempting to synchronize file changes to disk (fsync) while another thread truncates the file. This causes the fsync operation to retry indefinitely, potentially hanging the system and preventing legitimate file operations from completing.
Technical details
The vulnerability is a race condition deadloop in the f2fs_fsync_node_pages() function in fs/f2fs/node.c. When Thread A performs fsync and holds a reference to a folio (page), Thread B can simultaneously call f2fs_truncate(), which invalidates the folio's mapping via invalidate_mapping_pages(). This causes is_node_folio() to always return false, triggering an infinite retry loop with the condition "atomic && !marked" always remaining true. The fix adds a check after re-acquiring the folio lock to detect if the folio is no longer a valid node folio, returning -EAGAIN to exit the retry loop. The vulnerability affects the f2fs filesystem module and requires a race condition between fsync and truncate operations, but no special privileges or network access are needed—local access and filesystem activity are sufficient.
Affected products
- Linux Linux kernel multiple versions (f2fs filesystem module)
Timeline
- 2026-08-24: other: Fix authored by Chao Yu
- 2026-09-11: patched: Fix merged into stable kernel by Greg Kroah-Hartman
- 2026-09-16: disclosed: CVE-2026-89833 published